Can a file appear to be modified before it was created? [duplicate]

Is it possible to have a file which has a modified date that is before its created date? What actions would cause this event to occur?

If you create a file from scratch, it gets a creation time of "now", and a modification date of "now". Now imagine copying this file to another drive. Windows will keep the modification time, but the creation time of that file will be set to the time you copied the file to that drive (i.e. the time the file was created on that drive). Simple as that.

It’s actually correct:

• The last time the contents of the file were changed is stored in the modification time.
• The time the file was created on this very drive is stored in the creation time.

Consider a .tar archive that is extracted. Typically the extracted files will have a last modification timestamp assigned from the archive contents (which is typically in the past unless you are a time traveller). As far as the filesystem is concerned, these files have just been created though.

There also exist utilities to change the modification time of existing files, on Linux for example this is the touch command.

On Windows, it's very easy to set (falsify, if you will) a file's created and modified times. You don't have to change the computer's clock; you don't even need local admin access. All you need is write access to the file in question.

To set a file's creation time with PowerShell using SetCreationTime:

[System.IO.File]::SetCreationTime("C:\path\to\file.ext", (Get-Date "8/8/2088"))

To set the last-modified time using SetLastWriteTime:

[System.IO.File]::SetLastWriteTime("C:\path\to\file.ext", (Get-Date "7/4/1776"))

On Linux, you can easily change a file's last-modified time with the -d flag of touch, as shown in this Ask Ubuntu answer. There isn't really a notion of a creation date for files on Linux file systems (further reading at Unix & Linux).